v1.28.0 — agent-tunnel HTTP front-end

Feature: ask a published session from a program

agent-tunnel serve gains an HTTP front-end beside Discord and Mattermost, for callers that are programs rather than people: a docs site's "Ask" button, a script, a bot of your own. Turn it on with an [http] section (port, token_file; it binds to loopback). POST /ask names any live published handle, a question and a caller-chosen thread id; the same handle and thread share one read-only fork (read-only whatever the handle's access), so follow-ups remember earlier turns. Every route requires the shared secret as X-Ask-Token.

It runs through the same relay as the chat front-ends (concurrency cap, per-thread locks, fork refresh, logging). A failed turn is a 502 with the relay's own error text, and the response says whether a turn ran separately from what it produced. agent-tunnel doctor reports the front-end when it is configured.

The reference caller is the Jev wiki's /api/ask Cloudflare Pages Function, which verifies a Cloudflare Access identity and forwards questions to a published, pre-warmed "jev-expert" session on the maintainer's Mac.

Also in this release

• Mattermost front-end, and follow-ups that see the latest published session (#208).
• Forks created over HTTP stay read-only whatever the handle's access, the configured tool lists, the backends' extra args, the permission mode or settings-configured MCP servers.
• tmux window names now come from a digest of the whole thread key, so two threads of one handle can no longer share a fork.

What's Changed

• agent-tunnel: follow-ups see the latest session; Mattermost front-end by @pchalasani in https://github.com/pchalasani/claude-code-tools/pull/208

Full Changelog: https://github.com/pchalasani/claude-code-tools/compare/v1.27.1...v1.28.0